last executing test programs: 1m13.904575966s ago: executing program 1 (id=655): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/dlm\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/dlm/cluster\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f00000000a0)='./dev\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/dlm/cluster/comms\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/dlm/cluster/comms/1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/dlm/cluster/comms/1/nodeid\x00', 0x1, 0x0) write(r0, 0x0, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/dlm/cluster/comms/1/local\x00', 0x1, 0x0) close(r1) write(0xffffffffffffffff, &(0x7f0000000340)='127.0.0.1\n\x00', 0xa) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/dlm/cluster/spaces/ls1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/dlm/cluster/spaces/ls1/nodes/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/dlm/cluster/spaces/ls1/nodes/1/nodeid\x00', 0x1, 0x0) close(r2) write(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) nanosleep(0x0, 0x0) 1m11.920074144s ago: executing program 0 (id=656): r0 = syz_io_uring_setup(0xd3a, &(0x7f0000000080)={0x0, 0x2, 0x2, 0x3, 0x1f}, &(0x7f0000000040)=0x0, &(0x7f0000000300)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_modify_offsets$generic(r1, r2, 0x40, 0xffffffff) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_BASE(r4, 0x4008af04, &(0x7f0000000740)=0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, 0x0, &(0x7f0000000480)=""/53, 0x0, 0xd000}) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000300)={0x1, 0x0, [{0x58000, 0xac, &(0x7f0000000200)=""/172}]}) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f00000000c0)={0x1, 0x1, 0x0, 0x0, 0x0, 0x6000}) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$FAT_IOCTL_GET_VOLUME_ID(r0, 0x80047213, &(0x7f00000002c0)) syz_io_uring_submit$UBLK(r1, r2, r3, &(0x7f0000000980)=@ublk_start_dev_sqe={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207506, 0x0, 0x0, 0x0, 0x1, 0x8000000000000000}) r5 = add_key(&(0x7f0000000380)='cifs.idmap\x00', &(0x7f00000003c0)={'syz', 0x0}, &(0x7f00000004c0)="71211537a8e167d1323f21b049e71f91c0f3443f3edfec7dd6aead389287ef36c2242bdcfa996f0a5da366d918844066d1ffa69b90e457375d9d696ff41c914d22e8ee492131d9bf21385755ccdc0d92252e9f246143f8727138c161785217936de3d62d7218d744df9c753ffc04da789a67edb50e5ee454e00f58a4acb8a76d979bb424752e191e6b9032fab77de7ed682d2828a59c17e4202d3866fb429295fe42149a05b2f9a9263fc57611d65f", 0xaf, 0xfffffffffffffffe) keyctl$set_timeout(0xf, r5, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000007040)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SET_MM_MAP(0x22, 0xe, 0x0, 0x0) read$eventfd(r6, &(0x7f0000000340), 0x8) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x454600) 1m3.562926343s ago: executing program 1 (id=657): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) read$nci(r0, &(0x7f0000000200)=""/100, 0x64) write$nci(r0, &(0x7f0000000280)=@NCI_OP_CORE_RESET_RSP, 0x6) read$nci(r0, &(0x7f00000002c0)=""/100, 0x64) read$nci(r0, &(0x7f0000000380)=""/100, 0x64) write$nci(r0, &(0x7f0000000400)=@NCI_OP_RF_DISCOVER_MAP_RSP, 0x4) sendmsg$NFC_CMD_START_POLL(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x24, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0xffffffff}]}, 0x24}}, 0x0) read$nci(r0, &(0x7f0000000500)=""/100, 0x64) write$nci(r0, &(0x7f0000000580)=@NCI_OP_CORE_SET_CONFIG_RSP, 0x5) read$nci(r0, &(0x7f00000005c0)=""/100, 0x64) write$nci(r0, &(0x7f0000000640)=@NCI_OP_CORE_SET_CONFIG_RSP, 0x5) read$nci(r0, &(0x7f0000000680)=""/100, 0x64) write$nci(r0, &(0x7f0000000700)=@NCI_OP_RF_DISCOVER_RSP, 0x4) write$nci(r0, &(0x7f0000000740)=@NCI_OP_RF_DISCOVER_NTF={0x1, 0x0, 0x3, 0x3, 0x0, @b={0x0, 0x1, 0x1, 0x1, {0x1, "aa"}}}, 0xa) sendmsg$NFC_CMD_ACTIVATE_TARGET(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_TARGET_INDEX={0x8}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x1}]}, 0x2c}}, 0x0) read$nci(r0, &(0x7f0000000840)=""/100, 0x64) write$nci(r0, &(0x7f00000008c0)=@NCI_OP_CORE_CONN_CREATE_RSP={0x0, 0x0, 0x2, 0x4, 0x0, {0x0, 0x0, 0x0, 0x1}}, 0x7) 55.37785647s ago: executing program 0 (id=658): socket$nl_route(0x10, 0x3, 0x0) socket(0x2, 0x2, 0x1) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}], 0xa0}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 41.937866152s ago: executing program 0 (id=659): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/my_zoned_dev\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/my_zoned_dev/memory_backed\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0), 0x0) r1 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4e24, 0xb, @mcast2, 0x9}, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797afc3c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000010b615cd89f1b3621c000340000000022c00b3120e0a1f0200000000000000000a0000000900010073797a3100000000090002007379"], 0xcc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, 0x0, 0x10) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="180100003000010003000000fbdbdf2506"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) sendto$inet6(r1, &(0x7f0000000040)="800037bbfa9ba1", 0x7, 0x0, 0x0, 0x0) recvfrom$inet6(r1, &(0x7f0000000080)=""/240, 0xfffffffffffffcea, 0x10020, 0x0, 0x0) r2 = syz_open_procfs(0x0, 0x0) readv(r2, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/140, 0x8c}], 0x100000000000002a) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nullb/my_zoned_dev/power\x00', 0x2, 0x0) write(r3, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./dev/my_zoned_dev\x00', 0x2, 0x110) read(r4, &(0x7f0000000400), 0x200) r5 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000007, 0x12, r5, 0x49cf0000) read$midi(r5, &(0x7f0000000180)=""/4096, 0x1000) 39.118515862s ago: executing program 1 (id=660): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x40140921, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r0, &(0x7f0000000600)='3\n', 0x2) 31.641612528s ago: executing program 1 (id=661): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, 0x0, 0x2, 0x0) write$cgroup_type(r1, &(0x7f0000000280), 0x9) r2 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, 0x0, 0x0) write$cgroup_int(r4, &(0x7f0000000200)=0x1, 0x12) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_procs(r6, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r7, &(0x7f0000000c40), 0x12) 28.04770132s ago: executing program 0 (id=662): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:01.0/vendor\x00', 0x0, 0x0) read(r0, &(0x7f0000000200), 0x20) close(r0) 21.997066496s ago: executing program 1 (id=663): socket$nl_route(0x10, 0x3, 0x0) socket(0x2, 0x2, 0x1) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}], 0xa0}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 15.760191465s ago: executing program 0 (id=664): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x18, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x9, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000001000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000001b"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000680)={r1}, 0xc) 4.129547201s ago: executing program 1 (id=665): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0xa4, 0x0, &(0x7f0000000600)="878b7cdfd4455cf49da7ba6f280ae012ce80389a2aefe4fd04084554d7015aba5330d1b817d6c08af29938b8a9bc2b83462ddadaad3a3a5c0181a0203e49b12c99ac8757fc317fe672938a06f89c133d615cf8c6e94b3ac320fa50046f5c18ac35b49243870e4e6b90c76177feda5469369b2b5a4739cc0b68c1772f1c9b9320d88426bc8f139429054c85b62f2a1dfc705453bea4cabf1f5eee5a0d301fb7c62e36dba0"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 0s ago: executing program 0 (id=666): mount(0x0, &(0x7f0000000040)='./sys\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r0, 0x40140921, &(0x7f0000000440)="02000000") kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:55793' (ED25519) to the list of known hosts. syzkaller login: [ 685.382330][ T3245] cgroup: Unknown subsys name 'net' [ 686.870031][ T3245] cgroup: Unknown subsys name 'cpuset' [ 687.453074][ T3245] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 815.053806][ T3245] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 1053.425716][ T3258] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1054.470490][ T3258] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1054.741462][ T3259] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1055.706215][ T3259] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1082.082501][ T3258] hsr_slave_0: entered promiscuous mode [ 1082.179671][ T3258] hsr_slave_1: entered promiscuous mode [ 1085.797999][ T3259] hsr_slave_0: entered promiscuous mode [ 1085.983916][ T3259] hsr_slave_1: entered promiscuous mode [ 1086.051990][ T3259] debugfs: 'hsr0' already exists in 'hsr' [ 1086.073405][ T3259] Cannot create hsr debugfs directory [ 1106.641525][ T3258] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1107.033106][ T3258] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1107.331876][ T3258] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1107.782424][ T3258] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1107.913667][ T3258] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1108.343496][ T3258] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1108.723397][ T3258] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1109.543693][ T3258] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1117.111236][ T3259] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1117.863596][ T3259] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1118.024637][ T3259] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1118.342203][ T3259] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1118.524299][ T3259] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1119.253669][ T3259] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1119.528031][ T3259] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1120.964362][ T3259] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1159.739736][ T3258] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1166.063107][ T3259] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1301.306092][ T3258] veth0_vlan: entered promiscuous mode [ 1303.343023][ T3258] veth1_vlan: entered promiscuous mode [ 1308.946599][ T3258] veth0_macvtap: entered promiscuous mode [ 1310.192247][ T3258] veth1_macvtap: entered promiscuous mode [ 1311.809752][ T3259] veth0_vlan: entered promiscuous mode [ 1314.248594][ T3259] veth1_vlan: entered promiscuous mode [ 1319.681587][ T3340] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1320.188365][ T131] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1320.308863][ T3242] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1320.314445][ T3242] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1324.402423][ T3259] veth0_macvtap: entered promiscuous mode [ 1325.904640][ T3259] veth1_macvtap: entered promiscuous mode [ 1333.469378][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1334.529038][ T3262] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1334.533868][ T3262] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1335.948851][ T131] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1336.153514][ T3258] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 1382.798568][ T3887] netlink: 'syz.1.3': attribute type 4 has an invalid length. [ 1528.327905][ T3812] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 1529.181909][ T3812] usb 1-1: New USB device found, idVendor=0012, idProduct=0000, bcdDevice= 7.02 [ 1529.522895][ T3812] usb 1-1: Dual-Role OTG device on HNP port [ 1529.564335][ T3812] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1531.181161][ C1] configfs-gadget.g1 gadget.0: Using interface 0 [ 1533.221501][ T3812] usblp 1-1:1.0: usblp0: USB Bidirectional printer dev 2 if 0 alt 0 proto 2 vid 0x0012 pid 0x0000 [ 1540.192579][ T3948] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 1561.182843][ T3956] netlink: 12 bytes leftover after parsing attributes in process `syz.0.19'. [ 1571.940377][ T3961] process 'syz.1.20' launched './file1' with NULL argv: empty string added [ 1583.689256][ T3964] netlink: 'syz.0.21': attribute type 13 has an invalid length. [ 1583.719813][ T3964] netlink: 172 bytes leftover after parsing attributes in process `syz.0.21'. [ 1584.056821][ T3964] erspan0: refused to change device tx_queue_len [ 1588.703068][ T3966] netlink: 16 bytes leftover after parsing attributes in process `syz.1.22'. [ 1595.654699][ T3966] capability: warning: `syz.1.22' uses deprecated v2 capabilities in a way that may be insecure [ 1722.720793][ T31] audit: type=1800 audit(1721.500:2): pid=4021 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.34" name="memory_backed" dev="configfs" ino=4236 res=0 errno=0 [ 1730.908687][ T31] audit: type=1800 audit(1729.660:3): pid=4021 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.34" name="power" dev="configfs" ino=4275 res=0 errno=0 [ 1747.587653][ T4033] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1872.017642][ T4082] netlink: 16 bytes leftover after parsing attributes in process `syz.1.48'. [ 1878.712980][ T3879] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 1879.562725][ T3879] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1880.459128][ T3879] usb 2-1: not running at top speed; connect to a high speed hub [ 1880.461978][ T3879] usb 2-1: New USB device found, idVendor=0856, idProduct=ac22, bcdDevice=8d.52 [ 1881.159335][ T3879] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1881.162063][ T3879] usb 2-1: config 4 has 0 interfaces, different from the descriptor's value: 1 [ 1881.978183][ T3879] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1881.980675][ T3879] usb 2-1: Product: 訣闉挟ᷧϦ覚։౒㠪ꪶ䈊璞敼濰ᬊ궾Όᄭ“ાﳇ觀⾷塘낍皖瘁ﴕᬈᓴ޻䁯ָ阡⵶真눺㏧꜔ࣷ䞨㎆鱂觴坏짴جꗨ븬簕樄凞겧䀺쉌ꦩ闠诃岡䁘ᓺꢘꏤ澣䵔㾞諙继鬠찫폺㏎砬㯟撂ꌉ॑캑켣Ǵ璕ᘨ鰱품痎況浸馫㩣텆슱ؾ [ 1882.010399][ T3879] usb 2-1: Manufacturer: 䉨宍ᴕ쵰찣쵤꭯소筮缈晕濖᪂놚⣋乂⋝㶒彡鴴㸮鎔⤼뺡쏍騄敮풙⏈휕侥צּ﯆ꛒ쥠䐟鄅蠛낊㽽쉵᠟箯⤦腠㵰㝶佺䮻묵 [ 1882.033071][ T3879] usb 2-1: SerialNumber: ࠔ [ 1889.243292][ T3881] usb 2-1: USB disconnect, device number 2 [ 1909.318738][ T4108] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1909.554040][ T4111] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1909.578220][ T4111] block device autoloading is deprecated and will be removed. [ 1915.498743][ T4111] md/raid10:md0: not clean -- starting background reconstruction [ 1915.508146][ T4111] md/raid10:md0: active with 1 out of 2 devices [ 1915.658887][ T4111] md0: detected capacity change from 0 to 2048 [ 1916.439248][ T4120] md: resync of RAID array md0 [ 1918.156394][ T4120] md: md0: resync done. [ 1919.869294][ T4122] md: recover of RAID array md0 [ 1922.069632][ T4122] md: md0: recover done. [ 1932.720703][ T3881] usb 2-1: new low-speed USB device number 3 using dummy_hcd [ 1933.348275][ T3881] usb 2-1: New USB device found, idVendor=172f, idProduct=0501, bcdDevice= 0.00 [ 1933.444146][ T3881] usb 2-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid maxpacket 64, setting to 8 [ 1933.480104][ T3881] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1933.509870][ T3881] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1934.221702][ T3881] usb 2-1: config 0 descriptor?? [ 1934.457976][ T4128] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1939.839400][ T3881] usbhid 2-1:0.0: can't add hid device: -71 [ 1939.843252][ T3881] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1940.221291][ T3881] usb 2-1: USB disconnect, device number 3 [ 1950.560655][ T31] audit: type=1400 audit(1949.350:4): apparmor="DENIED" operation="change_hat" class="file" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=4147 comm="syz.1.62" [ 2008.569086][ T4195] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2008.710279][ T4195] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2032.034489][ T4209] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 2033.690288][ T4209] md: couldn't update array info. -22 [ 2034.031123][ T4209] md: could not open device unknown-block(1,1). [ 2034.050389][ T4209] md: md_import_device returned -16 [ 2034.416632][ T4209] md: could not open device unknown-block(1,2). [ 2034.423316][ T4209] md: md_import_device returned -16 [ 2042.739433][ T4216] netlink: 'syz.1.93': attribute type 1 has an invalid length. [ 2054.678239][ T4224] usb usb1: usbfs: process 4224 (syz.1.97) did not claim interface 0 before use [ 2071.994372][ T3879] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 2072.458533][ T3879] usb 2-1: Using ep0 maxpacket: 8 [ 2072.610932][ T3879] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 2072.984382][ T3879] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 2072.994267][ T3879] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2073.004101][ T3879] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 2073.012567][ T3879] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 2073.020152][ T3879] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2073.025888][ T3879] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2075.569527][ T3879] usb 2-1: GET_CAPABILITIES returned 0 [ 2075.571205][ T3879] usbtmc 2-1:16.0: can't read capabilities [ 2077.110455][ T3879] usb 2-1: USB disconnect, device number 4 [ 2100.789839][ T4268] comedi comedi3: no devices specified [ 2227.592730][ T4369] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 2265.055601][ T4400] netlink: 4 bytes leftover after parsing attributes in process `syz.0.170'. [ 2391.046992][ T4495] veth1_to_hsr: entered allmulticast mode [ 2445.344018][ T4539] netlink: 296 bytes leftover after parsing attributes in process `syz.0.236'. [ 2467.357972][ T4551] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 2613.205738][ T4616] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2613.651835][ T4616] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2705.559950][ T4666] random: crng reseeded on system resumption [ 2755.400230][ T4696] [U] #ي)|QP4}RDN"mx>)Na׽y߇g~"ý`U=pb [ 2811.484098][ T4278] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 2811.987192][ T4278] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 2812.567061][ T4278] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 2812.616442][ T4278] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2812.623912][ T4278] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 2812.626766][ T4278] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2812.904584][ T4278] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 2812.912614][ T4278] usb 2-1: Product: syz [ 2812.913524][ T4278] usb 2-1: Manufacturer: syz [ 2813.280754][ T4278] cdc_wdm 2-1:1.0: skipping garbage [ 2813.288164][ T4278] cdc_wdm 2-1:1.0: skipping garbage [ 2813.307744][ T4278] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 2817.141284][ T3881] usb 2-1: USB disconnect, device number 5 [ 2914.490832][ T4778] netlink: 24 bytes leftover after parsing attributes in process `syz.1.323'. [ 2953.701672][ T4801] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 2954.972880][ T4801] md: couldn't update array info. -22 [ 2957.099778][ T4801] md: could not open device unknown-block(1,1). [ 2957.187281][ T4801] md: md_import_device returned -16 [ 2957.901499][ T4801] md: could not open device unknown-block(1,2). [ 2957.913435][ T4801] md: md_import_device returned -16 [ 3018.591991][ T4829] fuse: Bad value for 'user_id' [ 3018.593586][ T4829] fuse: Bad value for 'user_id' [ 3030.881648][ T4835] binder: BINDER_SET_CONTEXT_MGR already set [ 3030.906274][ T4835] binder: 4834:4835 ioctl 4018620d 200000004a80 returned -16 [ 3056.689915][ T4843] binder: BINDER_SET_CONTEXT_MGR already set [ 3056.709213][ T4843] binder: 4841:4843 ioctl 4018620d 200000004a80 returned -16 [ 3059.959311][ T31] audit: type=1800 audit(3058.720:5): pid=4846 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.347" name="memory_backed" dev="configfs" ino=6044 res=0 errno=0 [ 3064.222949][ T31] audit: type=1800 audit(3063.020:6): pid=4848 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.347" name="power" dev="configfs" ino=6420 res=0 errno=0 [ 3197.463242][ T4911] cgroup: fork rejected by pids controller in /syz0 [ 3273.955687][ T4968] binder: BINDER_SET_CONTEXT_MGR already set [ 3273.957386][ T4968] binder: 4965:4968 ioctl 4018620d 200000004a80 returned -16 [ 3318.949948][ T4931] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3319.548862][ T4931] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3324.858872][ T31] audit: type=1800 audit(3323.640:7): pid=5092 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.381" name="memory_backed" dev="configfs" ino=7350 res=0 errno=0 [ 3325.602609][ T31] audit: type=1800 audit(3324.390:8): pid=5092 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.381" name="power" dev="configfs" ino=7352 res=0 errno=0 [ 3338.543650][ T5097] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 3339.631226][ T5097] md: couldn't update array info. -22 [ 3340.380506][ T5097] md: could not open device unknown-block(1,1). [ 3340.383853][ T5097] md: md_import_device returned -16 [ 3341.249527][ T5097] md: could not open device unknown-block(1,2). [ 3341.302325][ T5097] md: md_import_device returned -16 [ 3358.790321][ T4931] hsr_slave_0: entered promiscuous mode [ 3358.988144][ T4931] hsr_slave_1: entered promiscuous mode [ 3359.071919][ T4931] debugfs: 'hsr0' already exists in 'hsr' [ 3359.074112][ T4931] Cannot create hsr debugfs directory [ 3381.561003][ T4931] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3385.721373][ T4931] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3387.760319][ T4931] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3389.860850][ T4931] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3398.150940][ T4931] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 3398.382033][ T4931] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 3398.472249][ T4931] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 3398.783138][ T4931] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 3399.034376][ T4931] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 3399.292789][ T4931] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 3399.528190][ T4931] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 3399.986453][ T4931] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 3429.951132][ T4931] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3507.677392][ T5301] bond0: no command found in slaves file - use +ifname or -ifname [ 3524.825987][ T4931] veth0_vlan: entered promiscuous mode [ 3525.832586][ T4931] veth1_vlan: entered promiscuous mode [ 3529.656610][ T4931] veth0_macvtap: entered promiscuous mode [ 3530.302460][ T4931] veth1_macvtap: entered promiscuous mode [ 3536.338307][ T131] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3536.674304][ T4794] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3536.969840][ T3262] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3537.328663][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3571.111568][ T4918] hid-generic 0000:0001:0000.0001: unknown main item tag 0x0 [ 3571.123699][ T4918] hid-generic 0000:0001:0000.0001: unknown main item tag 0x0 [ 3571.131485][ T4918] hid-generic 0000:0001:0000.0001: unknown main item tag 0x0 [ 3571.142672][ T4918] hid-generic 0000:0001:0000.0001: unknown main item tag 0x0 [ 3571.153116][ T4918] hid-generic 0000:0001:0000.0001: unknown main item tag 0x0 [ 3571.161377][ T4918] hid-generic 0000:0001:0000.0001: unknown main item tag 0x0 [ 3571.177169][ T4918] hid-generic 0000:0001:0000.0001: unknown main item tag 0x0 [ 3571.182540][ T4918] hid-generic 0000:0001:0000.0001: unknown main item tag 0x0 [ 3571.206395][ T4918] hid-generic 0000:0001:0000.0001: unknown main item tag 0x0 [ 3571.214309][ T4918] hid-generic 0000:0001:0000.0001: unknown main item tag 0x0 [ 3571.827294][ T5333] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3572.127783][ T4918] hid-generic 0000:0001:0000.0001: hidraw0: HID v0.04 Device [syz1] on syz0 [ 3572.373529][ T5333] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3605.762835][ T5352] binder: 5351:5352 unknown command 0 [ 3605.768261][ T5352] binder: 5351:5352 ioctl c0306201 200000000640 returned -22 [ 3666.147244][ T5372] netlink: 16 bytes leftover after parsing attributes in process `syz.1.413'. [ 3738.640965][ T5406] binder_alloc: 5404: binder_alloc_buf, no vma [ 3771.912301][ T5422] binder: BINDER_SET_CONTEXT_MGR already set [ 3771.999878][ T5422] binder: 5421:5422 ioctl 4018620d 200000004a80 returned -16 [ 3816.568525][ T5444] binder_alloc: 5442: binder_alloc_buf, no vma [ 3840.956507][ T5455] md: couldn't update array info. -22 [ 3862.563484][ T5464] netlink: 'syz.1.442': attribute type 14 has an invalid length. [ 3883.882009][ T5479] ======================================================= [ 3883.882009][ T5479] WARNING: The mand mount option has been deprecated and [ 3883.882009][ T5479] and is ignored by this kernel. Remove the mand [ 3883.882009][ T5479] option from the mount to silence this warning. [ 3883.882009][ T5479] ======================================================= [ 3993.240425][ T31] audit: type=1800 audit(3992.030:9): pid=5529 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.461" name="memory_backed" dev="configfs" ino=8153 res=0 errno=0 [ 3995.489863][ T31] audit: type=1800 audit(3994.270:10): pid=5530 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.461" name="power" dev="configfs" ino=6825 res=0 errno=0 [ 4041.252704][ T31] audit: type=1800 audit(4040.040:11): pid=5546 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.467" name="memory_backed" dev="configfs" ino=6837 res=0 errno=0 [ 4043.849530][ T31] audit: type=1800 audit(4042.630:12): pid=5554 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.467" name="power" dev="configfs" ino=6840 res=0 errno=0 [ 4118.633854][ T31] audit: type=1800 audit(4117.410:13): pid=5593 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.478" name="memory_backed" dev="configfs" ino=8275 res=0 errno=0 [ 4121.250260][ T31] audit: type=1800 audit(4120.050:14): pid=5594 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.478" name="power" dev="configfs" ino=8279 res=0 errno=0 [ 4162.502516][ T5432] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 4162.877137][ T5432] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 4163.048202][ T5432] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 4163.052003][ T5432] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 4163.054570][ T5432] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 4163.662561][ T5612] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 4164.406825][ T5432] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 4169.736462][ T5432] usb 2-1: USB disconnect, device number 6 [ 4229.227609][ T31] audit: type=1800 audit(4227.990:15): pid=5667 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.493" name="memory_backed" dev="configfs" ino=6893 res=0 errno=0 [ 4266.505901][ T31] audit: type=1800 audit(4265.300:16): pid=5680 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.499" name="memory_backed" dev="configfs" ino=8420 res=0 errno=0 [ 4335.881835][ T5710] netlink: 'syz.0.510': attribute type 1 has an invalid length. [ 4403.043698][ T5739] binder_alloc: 5738: binder_alloc_buf, no vma [ 4528.291736][ T31] audit: type=1800 audit(4527.080:17): pid=5791 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.538" name="memory_backed" dev="configfs" ino=8656 res=0 errno=0 [ 4531.363948][ T31] audit: type=1800 audit(4530.150:18): pid=5792 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.538" name="power" dev="configfs" ino=7007 res=0 errno=0 [ 4570.447680][ T31] audit: type=1800 audit(4569.240:19): pid=5811 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.545" name="memory_backed" dev="configfs" ino=8699 res=0 errno=0 [ 4573.080605][ T31] audit: type=1800 audit(4571.840:20): pid=5812 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.545" name="power" dev="configfs" ino=7015 res=0 errno=0 [ 4605.050116][ T5825] binder: BINDER_SET_CONTEXT_MGR already set [ 4605.052112][ T5825] binder: 5824:5825 ioctl 4018620d 200000004a80 returned -16 [ 4617.621259][ T5837] netlink: 224 bytes leftover after parsing attributes in process `syz.0.552'. [ 4617.642146][ T5837] netlink: 80 bytes leftover after parsing attributes in process `syz.0.552'. [ 4632.884614][ T31] audit: type=1800 audit(4631.660:21): pid=5840 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.553" name="memory_backed" dev="configfs" ino=8750 res=0 errno=0 [ 4635.838677][ T31] audit: type=1800 audit(4634.630:22): pid=5844 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.553" name="power" dev="configfs" ino=8756 res=0 errno=0 [ 4651.248405][ T5852] binder: BINDER_SET_CONTEXT_MGR already set [ 4651.250359][ T5852] binder: 5850:5852 ioctl 4018620d 200000004a80 returned -16 [ 4663.658988][ T31] audit: type=1800 audit(4662.430:23): pid=5857 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.558" name="memory_backed" dev="configfs" ino=8779 res=0 errno=0 [ 4665.125846][ T31] audit: type=1800 audit(4663.900:24): pid=5859 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.558" name="power" dev="configfs" ino=8784 res=0 errno=0 [ 4665.716782][ T5858] Console: switching to colour dummy device 80x25 [ 4679.243917][ T31] audit: type=1800 audit(4678.030:25): pid=5863 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.559" name="memory_backed" dev="configfs" ino=8789 res=0 errno=0 [ 4681.030626][ T31] audit: type=1800 audit(4679.800:26): pid=5864 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.559" name="power" dev="configfs" ino=8795 res=0 errno=0 [ 4694.571449][ T5870] binder: BINDER_SET_CONTEXT_MGR already set [ 4694.576170][ T5870] binder: 5869:5870 ioctl 4018620d 200000004a80 returned -16 [ 4705.000432][ T31] audit: type=1800 audit(4703.710:27): pid=5873 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.563" name="memory_backed" dev="configfs" ino=7053 res=0 errno=0 [ 4707.493907][ T31] audit: type=1800 audit(4706.280:28): pid=5873 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.563" name="power" dev="configfs" ino=8816 res=0 errno=0 [ 4708.836470][ T5875] faux_driver vgem: [drm] Unknown color mode 127; guessing buffer size. [ 4811.351827][ T31] audit: type=1800 audit(4810.150:29): pid=5928 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.579" name="power" dev="configfs" ino=7091 res=0 errno=0 [ 4823.363902][ T31] audit: type=1800 audit(4822.160:30): pid=5932 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.580" name="memory_backed" dev="configfs" ino=7098 res=0 errno=0 [ 4826.457447][ T31] audit: type=1800 audit(4825.250:31): pid=5933 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.580" name="power" dev="configfs" ino=8905 res=0 errno=0 [ 5117.533039][ T31] audit: type=1800 audit(5116.330:32): pid=6111 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.622" name="memory_backed" dev="configfs" ino=9149 res=0 errno=0 [ 5119.671142][ T31] audit: type=1800 audit(5118.380:33): pid=6112 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.622" name="power" dev="configfs" ino=9154 res=0 errno=0 [ 5160.974520][ T31] audit: type=1800 audit(5159.760:34): pid=6130 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.629" name="memory_backed" dev="configfs" ino=9191 res=0 errno=0 [ 5163.541617][ T31] audit: type=1800 audit(5162.340:35): pid=6131 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.629" name="power" dev="configfs" ino=9272 res=0 errno=0 [ 5296.230711][ T31] audit: type=1800 audit(5295.000:36): pid=6187 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.649" name="memory_backed" dev="configfs" ino=9317 res=0 errno=0 [ 5369.228015][ T31] audit: type=1800 audit(5368.020:37): pid=6225 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.659" name="memory_backed" dev="configfs" ino=10442 res=0 errno=0 [ 5371.405564][ T31] audit: type=1800 audit(5370.190:38): pid=6227 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.659" name="power" dev="configfs" ino=10444 res=0 errno=0 [ 5408.097283][ T6242] [ 5408.097978][ T6242] ====================================================== [ 5408.098567][ T6242] WARNING: possible circular locking dependency detected [ 5408.099925][ T6242] syzkaller #0 Tainted: G L [ 5408.100533][ T6242] ------------------------------------------------------ [ 5408.101098][ T6242] syz.0.666/6242 is trying to acquire lock: [ 5408.101690][ T6242] ffffffff88f4d6a0 (major_names_lock){+.+.}-{4:4}, at: blk_probe_dev+0x2e/0x1be [ 5408.104347][ T6242] [ 5408.104347][ T6242] but task is already holding lock: [ 5408.105280][ T6242] ffffaf8032ea2358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: md_ioctl+0x1466/0x33f0 [ 5408.107883][ T6242] [ 5408.107883][ T6242] which lock already depends on the new lock. [ 5408.107883][ T6242] [ 5408.108625][ T6242] [ 5408.108625][ T6242] the existing dependency chain (in reverse order) is: [ 5408.109325][ T6242] [ 5408.109325][ T6242] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 5408.110600][ T6242] lock_acquire+0x23c/0x4f0 [ 5408.111400][ T6242] __mutex_lock+0x164/0x1924 [ 5408.112065][ T6242] mutex_lock_nested+0x14/0x1c [ 5408.112730][ T6242] md_start_sync+0x4c4/0xd56 [ 5408.113393][ T6242] process_one_work+0x9c6/0x22b2 [ 5408.114178][ T6242] worker_thread+0x532/0xcaa [ 5408.115093][ T6242] kthread+0x312/0x438 [ 5408.115841][ T6242] ret_from_fork_kernel+0x94/0xe74 [ 5408.116531][ T6242] ret_from_fork_kernel_asm+0x16/0x18 [ 5408.117381][ T6242] [ 5408.117381][ T6242] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 5408.118566][ T6242] lock_acquire+0x23c/0x4f0 [ 5408.119403][ T6242] process_one_work+0x904/0x22b2 [ 5408.120278][ T6242] worker_thread+0x532/0xcaa [ 5408.121050][ T6242] kthread+0x312/0x438 [ 5408.121809][ T6242] ret_from_fork_kernel+0x94/0xe74 [ 5408.122496][ T6242] ret_from_fork_kernel_asm+0x16/0x18 [ 5408.123455][ T6242] [ 5408.123455][ T6242] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 5408.124662][ T6242] lock_acquire+0x23c/0x4f0 [ 5408.125416][ T6242] touch_wq_lockdep_map+0xa0/0x18e [ 5408.126176][ T6242] __flush_workqueue+0x104/0xe56 [ 5408.127031][ T6242] md_alloc+0x30/0xf8e [ 5408.127720][ T6242] md_probe+0x96/0x134 [ 5408.128341][ T6242] blk_probe_dev+0x12a/0x1be [ 5408.129036][ T6242] blk_request_module+0x1c/0xec [ 5408.129810][ T6242] blkdev_get_no_open+0xbe/0x11c [ 5408.130513][ T6242] blkdev_open+0x126/0x452 [ 5408.131269][ T6242] do_dentry_open+0x418/0x1176 [ 5408.132288][ T6242] vfs_open+0xba/0x3dc [ 5408.133029][ T6242] path_openat+0x18a2/0x2248 [ 5408.133897][ T6242] do_file_open+0x1ae/0x398 [ 5408.134894][ T6242] do_sys_openat2+0x102/0x1ca [ 5408.135622][ T6242] __riscv_sys_openat+0x122/0x1f2 [ 5408.136345][ T6242] syscall_handler+0x92/0x114 [ 5408.137093][ T6242] do_trap_ecall_u+0x4ca/0x658 [ 5408.137895][ T6242] handle_exception+0x168/0x174 [ 5408.138858][ T6242] [ 5408.138858][ T6242] -> #0 (major_names_lock){+.+.}-{4:4}: [ 5408.140173][ T6242] check_noncircular+0x138/0x14c [ 5408.141030][ T6242] __lock_acquire+0xe9c/0x25aa [ 5408.141975][ T6242] lock_acquire+0x23c/0x4f0 [ 5408.142961][ T6242] __mutex_lock+0x164/0x1924 [ 5408.143771][ T6242] mutex_lock_nested+0x14/0x1c [ 5408.144497][ T6242] blk_probe_dev+0x2e/0x1be [ 5408.145415][ T6242] blk_request_module+0x1c/0xec [ 5408.146309][ T6242] blkdev_get_no_open+0xbe/0x11c [ 5408.147144][ T6242] bdev_file_open_by_dev+0x70/0x202 [ 5408.147899][ T6242] md_import_device+0x130/0x41c [ 5408.148749][ T6242] md_add_new_disk+0xb0e/0x1784 [ 5408.149539][ T6242] md_ioctl+0x24dc/0x33f0 [ 5408.150449][ T6242] blkdev_ioctl+0x4cc/0x12e4 [ 5408.151492][ T6242] __riscv_sys_ioctl+0x17c/0x1e2 [ 5408.152397][ T6242] syscall_handler+0x92/0x114 [ 5408.153263][ T6242] do_trap_ecall_u+0x4ca/0x658 [ 5408.154083][ T6242] handle_exception+0x168/0x174 [ 5408.155098][ T6242] [ 5408.155098][ T6242] other info that might help us debug this: [ 5408.155098][ T6242] [ 5408.155885][ T6242] Chain exists of: [ 5408.155885][ T6242] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 5408.155885][ T6242] [ 5408.157887][ T6242] Possible unsafe locking scenario: [ 5408.157887][ T6242] [ 5408.158507][ T6242] CPU0 CPU1 [ 5408.159065][ T6242] ---- ---- [ 5408.159587][ T6242] lock(&mddev->reconfig_mutex); [ 5408.160394][ T6242] lock((work_completion)(&mddev->sync_work)); [ 5408.161454][ T6242] lock(&mddev->reconfig_mutex); [ 5408.162571][ T6242] lock(major_names_lock); [ 5408.163578][ T6242] [ 5408.163578][ T6242] *** DEADLOCK *** [ 5408.163578][ T6242] [ 5408.164328][ T6242] locks held by syz.0.666/6242: 1, last CPU#0: [ 5408.165016][ T6242] #0: ffffaf8032ea2358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: md_ioctl+0x1466/0x33f0 [ 5408.167221][ T6242] [ 5408.167221][ T6242] stack backtrace: [ 5408.168749][ T6242] CPU: 0 UID: 0 PID: 6242 Comm: syz.0.666 Tainted: G L syzkaller #0 PREEMPT [ 5408.169367][ T6242] Tainted: [L]=SOFTLOCKUP [ 5408.169524][ T6242] Hardware name: riscv-virtio,qemu (DT) [ 5408.170012][ T6242] Call Trace: [ 5408.170235][ T6242] [] dump_backtrace+0x2e/0x3c [ 5408.170749][ T6242] [] show_stack+0x30/0x3c [ 5408.171058][ T6242] [] dump_stack_lvl+0x114/0x1aa [ 5408.171395][ T6242] [] dump_stack+0x1c/0x24 [ 5408.171765][ T6242] [] print_circular_bug+0x250/0x29c [ 5408.172194][ T6242] [] check_noncircular+0x138/0x14c [ 5408.172662][ T6242] [] __lock_acquire+0xe9c/0x25aa [ 5408.173087][ T6242] [] lock_acquire+0x23c/0x4f0 [ 5408.173477][ T6242] [] __mutex_lock+0x164/0x1924 [ 5408.173788][ T6242] [] mutex_lock_nested+0x14/0x1c [ 5408.174104][ T6242] [] blk_probe_dev+0x2e/0x1be [ 5408.174424][ T6242] [] blk_request_module+0x1c/0xec [ 5408.174825][ T6242] [] blkdev_get_no_open+0xbe/0x11c [ 5408.175189][ T6242] [] bdev_file_open_by_dev+0x70/0x202 [ 5408.175546][ T6242] [] md_import_device+0x130/0x41c [ 5408.175985][ T6242] [] md_add_new_disk+0xb0e/0x1784 [ 5408.176397][ T6242] [] md_ioctl+0x24dc/0x33f0 [ 5408.176765][ T6242] [] blkdev_ioctl+0x4cc/0x12e4 [ 5408.177094][ T6242] [] __riscv_sys_ioctl+0x17c/0x1e2 [ 5408.177401][ T6242] [] syscall_handler+0x92/0x114 [ 5408.177766][ T6242] [] do_trap_ecall_u+0x4ca/0x658 [ 5408.178193][ T6242] [] handle_exception+0x168/0x174 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 5411.340281][ T6242] md: could not open device unknown-block(0,0). [ 5411.373035][ T6242] md: md_import_device returned -6 [ 5435.220097][ T5842] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 5437.481661][ T5842] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0